L1 Engineer - Forcepoint DLP

Engineer 1 – L1 (Security Operations Engineer)

Job Title: L1 Engineer – Forcepoint DLP & DSPM (On-Site Resident Engineer)

Experience: 2–4 years in IT Security / DLP Operations

Location: On-site (Client Location)

Shift: 24/7 rotational shift (as per SLA)

Key Responsibilities

1. Daily Operations & Monitoring

• Monitor Forcepoint DLP and DSPM consoles 24/7 for alerts, incidents, and system health
• Review daily dashboards, incident queues, and system performance metrics
• Perform routine health checks on DLP enforcers, endpoints, agents, and DSPM connectors
• Ensure zero missed SLA conditions for incident acknowledgment and resolution
• Execute daily backup of configuration files and logs; move backups to external storage

2. L1 Incident Response

• Handle first-line support for standard and low-complexity DLP/DSPM incidents
• Triage alerts from DLP Engine: Endpoint, Network, Email, Web, Cloud, and DSPM
• Acknowledge incidents within SLA and perform initial investigation
• Categorize and prioritize incidents based on severity (Critical, High, Medium, Low)
• Escalate complex issues to L2 Engineer with detailed notes and logs
• Update incident tickets with status, actions taken, and resolution details

3. Endpoint Agent Monitoring & Basic Troubleshooting

• Monitor Forcepoint Endpoint Agent health across Windows/Mac devices
• Identify agents offline, communication failures, or policy sync issues
• Perform basic troubleshooting: restart agent, check connectivity, verify policy deployment
• Document recurring issues and escalate persistent problems to L2
• Assist with endpoint agent rollouts and uninstall/reinstall under L2 guidance

4. Policy & Classification Monitoring

• Monitor policy hits and false positives for DLP and DSPM classifiers
• Track endpoint classification events (MIP labels, custom labels, sensitivity tags)
• Generate daily/weekly reports on:
• Top incidents by category (USB, Email, Web, Print, Cloud)
• Policy hit trends
• Endpoint agent status
• DSPM data discovery results

5. Documentation & Reporting

• Maintain daily operation logs, incident logs, and escalation records
• Update knowledge base with common issues and resolutions
• Prepare weekly status reports for client and internal management
• Document change requests and maintenance activities

6. Vendor & Stakeholder Coordination

• Communicate with Forcepoint support for severity-1/severity-2 escalations
• Coordinate with client IT teams for endpoint access, network connectivity, and AD sync issues
• Participate in daily stand-up meetings and shift handovers

Required Skills & Qualifications

Education

B.E./B.Tech in IT/Computer Science or MCA

Experience

2–4 years in IT Security, preferably DLP/Endpoint Security operations

Technical Skills

• Basic knowledge of Forcepoint DLP (Endpoint, Network, Email, Web)
• Familiarity with Forcepoint DSPM concepts (data discovery, classification)
• Understanding of Active Directory, Windows/Mac endpoints, network ports
• Basic troubleshooting of agents, policies, and incidents
• Knowledge of DLP detection methods: Regex, Dictionary, Fingerprinting, OCR, Exact Data Matching (EDM)

Tools

• Forcepoint Security Manager (FSM) or ONE Data Security portal
• SIEM (Splunk/QRadar) for log viewing
• ServiceNow/Jira for ticket management
• VPN, remote access tools

Soft Skills

• Strong communication ( verbal & written)
• Ability to work in shifts
• Detail-oriented, proactive, SLA-driven
• Team player, willing to learn

Certifications (Preferred)

• Forcepoint DLP training/certification
• Security+ / CEH / PCNSE (optional)